Description

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.

Remediation

References

CVE-2025-59017

Related Vulnerabilities

Wordpress Plugin Backup Migration Files or Directories Accessible to External Parties Vulnerability (CVE-2023-6266)

WordPress Plugin Background Music Cross-Site Scripting (1.0)

WordPress Plugin SEO Friendly Images Cross-Site Scripting (3.0.4)

WordPress Plugin Team Members Cross-Site Scripting (5.1.0)

Vanilla Forums Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4954)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-862 CVE-2025-59017